Researchers Use AI to Discover Critical Linux Kernel Flaw That Enables Virtual Machine Escape
pwn.ai found Linux kernel flaw CVE-2026-99999, which leaked host memory and escaped a guest VM in lab tests.
pwn.ai researchers used an AI-assisted harness, Omega-Pwn with GPT-5.6 Sol, to find CVE-2026-99999, a critical Linux kernel networking flaw nicknamed PwnEscape. A guest can supply malicious virtio checksum metadata so fragmentation copies 32 bytes of host kernel memory into a packet; on the researchers’ own KVM test hosts they also demonstrated selected host-kernel writes and a host-root helper. They do not claim production exploitation and expect weaker configurations to be exploited within weeks. The accepted patch, commit 6785011f8b16, rejects invalid csum_start values, while stable backports and CVE publication are still being finalized.
- CVE-2026-99999, nicknamed PwnEscape, is in the Linux networking stack, not KVM.
- Guest-controlled virtio checksum metadata can leak 32 bytes of host kernel memory.
- Researchers reached host-root on their own KVM lab hosts across four cold boots.
- Patch commit 6785011f8b16 validates csum_start before checksum completion.
- Discovery used GPT-5.6 Sol through Omega-Pwn and cost under $700 in API tokens.
Vulnerabilities mentionedAll →
- CVE-2026-999999.3—Linux kernel IPv4 checksum metadata can corrupt headerspublished · Linux kernel (IPv4 stack)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-99999 | Linux kernel IPv4 checksum metadata can corrupt headers A flaw in the Linux kernel IPv4 stack allows a packet that already carries bad checksum metadata to reach skb_checksum_help, which can corrupt the network header. It is triggered when such a packet is inside the IPv4 path; the published change validates checksum_start before the checksum is completed as defense in depth, and the note says fuller validation on input is still forthcoming. The kernel description limits the effect to header corruption and related mischief, while the CVSS 3.1 score of 9.3 rates a local, unprivileged attack with changed scope and high confidentiality, integrity, and availability impact. Linux systems whose kernels include the unfixed IPv4 checksum-completion path are in scope, but affected version ranges are not listed. It is not in the CISA KEV catalog and no public proof-of-concept is known. |
Full article529 words · extracted from gbhackers.com · click to collapse
Researchers at pwn.ai used an AI-assisted research harness to find a critical Linux kernel networking flaw, tracked as CVE-2026-99999 and nicknamed “PwnEscape”.
It lets an untrusted guest virtual machine leak host kernel memory and, in lab conditions, escape to the host. The bug is in the Linux networking stack, not in KVM or any hypervisor.
Linux kernel VM escape
According to research published by pwn.ai, the discovery came from Vercel’s $1 million Sandbox challenge, announced on August 18, 2026.
Researchers used Omega-Pwn, an experimental harness that draws on elements of OmegaClaw and uses GPT-5.6 Sol for source-level analysis. Humans set the scope and decided what counted as evidence.
They reached the first primitive within three days. They say the whole effort cost under $700 in API tokens. Vercel called it the program’s most important report and recorded it as its only Critical finding.
The flaw involves deferred checksum metadata in the Linux sk_buff structure. When a packet is marked CHECKSUM_PARTIAL, the fields csum_start and csum_offset decide where the kernel will later write the checksum. A guest can control these values through virtio.
The kernel first parses an IPv4 header with a header length (IHL) of 5, which is 20 bytes. Later, during output fragmentation, ip_do_fragment() calls skb_checksum_help().
With malicious metadata, that call overwrites the header’s first byte, changing it from 0x45 to 0x4f. The fragmenter then treats the header as 60 bytes long.
The logical linear data was only 28 bytes. The fragmenter therefore copied 32 bytes of host memory into the outgoing packet as apparent IP options. This is a time-of-check/time-of-use problem, but a deterministic one rather than a thread race. The researchers call the pattern “deferred-metadata trust inversion”.
The researchers escalated the 32-byte disclosure on their own KVM test hosts. They demonstrated selected 64-byte host-kernel writes and executed a host-root helper. Four separate cold boots completed the chain.
They also confirmed a host-availability failure on Linux 6.12 and 7.x test hosts. They stress that this was not a claim of root access in any vendor’s production environment.
They expect exploits for weaker configurations within weeks. They expect exploits for default hypervisor configurations in under a month.
The accepted patch is commit 6785011f8b16, “ipv4: validate checksum_start before completing checksum”. It was written by Michael S. Tsirkin. It adds an ip_check_csum_start() helper that rejects any csum_start below the network header start plus the IPv4 header length.
The check is placed before checksum completion at five consumer sites. The commit describes the patch as defense in depth, and broader ingress validation still needs work.
Recommended actions include applying kernel updates once stable backports land, while checking live kernel records because CVE publication and backports are still being finalized.
Hypervisor and sandbox providers should review their own exposure, as Vercel has notified other affected providers. Security teams should also treat host networking as part of the VM isolation boundary, and monitor for guest traffic carrying unusual IPv4 options.
The researchers plan a second article covering the move from the primitive to full host control. They also plan a separate post on the network-escape findings.